]>
Commit | Line | Data |
---|---|---|
191976ef MT |
1 | From 83ed574998fe7b844b98ab7cd56291068feb9e31 Mon Sep 17 00:00:00 2001 |
2 | From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15> | |
3 | Date: Sat, 16 May 2015 11:05:40 +0000 | |
4 | Subject: [PATCH] Fix named forward reference to duplicate group number | |
5 | overflow bug. | |
6 | MIME-Version: 1.0 | |
7 | Content-Type: text/plain; charset=UTF-8 | |
8 | Content-Transfer-Encoding: 8bit | |
9 | ||
10 | Port to 8.37: | |
11 | ||
12 | commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447 | |
13 | Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15> | |
14 | Date: Sat May 16 11:05:40 2015 +0000 | |
15 | ||
16 | Fix named forward reference to duplicate group number overflow bug. | |
17 | ||
18 | git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1559 2f5784b3-3f2a-0410-8824-cb99058d5e15 | |
19 | ||
20 | Signed-off-by: Petr Písař <ppisar@redhat.com> | |
21 | --- | |
22 | pcre_compile.c | 24 ++++++++++++++++-------- | |
23 | testdata/testinput1 | 3 +++ | |
24 | testdata/testoutput1 | 5 +++++ | |
25 | 3 files changed, 24 insertions(+), 8 deletions(-) | |
26 | ||
27 | diff --git a/pcre_compile.c b/pcre_compile.c | |
28 | index b66b1f6..8b4aaef 100644 | |
29 | --- a/pcre_compile.c | |
30 | +++ b/pcre_compile.c | |
31 | @@ -7183,15 +7183,15 @@ for (;; ptr++) | |
32 | open_capitem *oc; | |
33 | recno = ng->number; | |
34 | if (is_recurse) break; | |
35 | - for (oc = cd->open_caps; oc != NULL; oc = oc->next) | |
36 | - { | |
37 | - if (oc->number == recno) | |
38 | - { | |
39 | - oc->flag = TRUE; | |
40 | + for (oc = cd->open_caps; oc != NULL; oc = oc->next) | |
41 | + { | |
42 | + if (oc->number == recno) | |
43 | + { | |
44 | + oc->flag = TRUE; | |
45 | break; | |
46 | - } | |
47 | - } | |
48 | - } | |
49 | + } | |
50 | + } | |
51 | + } | |
52 | } | |
53 | ||
54 | /* Count named back references. */ | |
55 | @@ -7203,6 +7203,14 @@ for (;; ptr++) | |
56 | 16-bit data item. */ | |
57 | ||
58 | *lengthptr += IMM2_SIZE; | |
59 | + | |
60 | + /* If this is a forward reference and we are within a (?|...) group, | |
61 | + the reference may end up as the number of a group which we are | |
62 | + currently inside, that is, it could be a recursive reference. In the | |
63 | + real compile this will be picked up and the reference wrapped with | |
64 | + OP_ONCE to make it atomic, so we must space in case this occurs. */ | |
65 | + | |
66 | + if (recno == 0) *lengthptr += 2 + 2*LINK_SIZE; | |
67 | } | |
68 | ||
69 | /* In the real compile, search the name table. We check the name | |
70 | diff --git a/testdata/testinput1 b/testdata/testinput1 | |
71 | index 73c2f4d..8379ce0 100644 | |
72 | --- a/testdata/testinput1 | |
73 | +++ b/testdata/testinput1 | |
74 | @@ -5730,4 +5730,7 @@ AbcdCBefgBhiBqz | |
75 | "(?1)(?#?'){8}(a)" | |
76 | baaaaaaaaac | |
77 | ||
78 | +"(?|(\k'Pm')|(?'Pm'))" | |
79 | + abcd | |
80 | + | |
81 | /-- End of testinput1 --/ | |
82 | diff --git a/testdata/testoutput1 b/testdata/testoutput1 | |
83 | index 0a53fd0..e852ab9 100644 | |
84 | --- a/testdata/testoutput1 | |
85 | +++ b/testdata/testoutput1 | |
86 | @@ -9429,4 +9429,9 @@ No match | |
87 | 0: aaaaaaaaa | |
88 | 1: a | |
89 | ||
90 | +"(?|(\k'Pm')|(?'Pm'))" | |
91 | + abcd | |
92 | + 0: | |
93 | + 1: | |
94 | + | |
95 | /-- End of testinput1 --/ | |
96 | -- | |
97 | 2.4.3 | |
98 |